# Static, outbound-only M4 runtime worker slot for a remote GPU node.
services:
  runtime-worker:
    # Release and acceptance deployments set this to an immutable tag or digest. The local
    # fallback remains source-buildable but never floats to `latest`.
    image: ${MODELFORGE_RUNTIME_WORKER_IMAGE:-modelforge-runtime-worker:${MODELFORGE_VERSION:-local}}
    build:
      context: .
      dockerfile: runtime-worker/Dockerfile
      args:
        MODELFORGE_VERSION: ${MODELFORGE_VERSION:-0.0.0}
        MODELFORGE_COMMIT: ${MODELFORGE_COMMIT:-}
        MODELFORGE_BUILT_AT: ${MODELFORGE_BUILT_AT:-}
    hostname: ${MODELFORGE_AGENT_HOSTNAME:-modelforge-node-agent}-runtime
    env_file:
      - path: .env
        required: false
    environment:
      MODELFORGE_RUNTIME_WORKER_CONTROL_PLANE_URL: ${MODELFORGE_AGENT_CONTROL_PLANE_URL:-https://modelforge.example.invalid}
      MODELFORGE_RUNTIME_WORKER_CREDENTIAL_FILE: /run/node-state/node-credential
      MODELFORGE_RUNTIME_WORKER_ARTIFACT_ROOT: /models/model-registry
      MODELFORGE_RUNTIME_WORKER_TLS_VERIFY: ${MODELFORGE_AGENT_TLS_VERIFY:-true}
      MODELFORGE_RUNTIME_WORKER_POLL_INTERVAL_SECONDS: ${MODELFORGE_RUNTIME_WORKER_POLL_INTERVAL_SECONDS:-1}
      HF_HUB_OFFLINE: "1"
      TRANSFORMERS_OFFLINE: "1"
      HF_DATASETS_OFFLINE: "1"
      TOKENIZERS_PARALLELISM: "false"
    volumes:
      - ${MODELFORGE_AGENT_STATE_VOLUME:-node-agent-state}:/run/node-state:ro
      - ${MODELFORGE_AGENT_ARTIFACT_VOLUME:-model-artifacts}:/models:ro
    read_only: true
    tmpfs:
      - /tmp:size=512m,mode=1777
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
    pids_limit: 512
    restart: unless-stopped
    deploy:
      resources:
        reservations:
          devices:
            - driver: nvidia
              count: 1
              capabilities: [gpu]

volumes:
  node-agent-state:
  model-artifacts: